The SimplePractice lawsuit is a class action investigation, not yet a publicly docketed case with a named plaintiff, into allegations that the therapy practice management platform embedded tracking pixels from Meta, Google, and TikTok in the portal that clients use to book appointments, complete intake forms, and message their therapists. Attorneys working with ClassAction.org are pursuing the claims under privacy and wiretapping theories.1Robin Levick. SimplePractice Tracking Pixels SimplePractice denies the allegations, and its August 2023 terms of service now include a binding arbitration clause and a class action waiver that could stand between plaintiffs and a courtroom.
What the Allegations Say
The core claim is that pixels loaded on the client-facing portal transmitted IP addresses, device identifiers, and real-time behavioral data to Meta, Google, and TikTok whenever a client visited. The sensitivity is specific to mental health. According to guidance the HHS Office for Civil Rights has issued, combining a person’s identity with the fact that they are visiting a mental health provider’s portal can itself constitute protected health information under HIPAA, even without any exposure of clinical notes or diagnoses.1Robin Levick. SimplePractice Tracking Pixels
The allegations do not claim that clinical data stored inside the EHR itself was shared with those third parties. The theory is narrower: that the pixels’ presence on portal pages disclosed a therapeutic relationship, which is enough to trigger HIPAA and consumer privacy laws.1Robin Levick. SimplePractice Tracking Pixels
SimplePractice’s Denial
SimplePractice has rejected the allegations. In a statement published on its blog, the company said there are “no third-party pixels in the SimplePractice product,” referring to both its clinician portal and its client portal, and that its records show it has never integrated pixels into the client portal.2SimplePractice. Security and Third-Party Pixels
The company acknowledged using third-party pixels on its public marketing site at simplepractice.com but distinguished that site from any page where client information is collected or displayed. It said it does not use tracking pixels on its therapist directory (TherapyFinder.com) or the client portal, and that it never passes personal health information to third parties through its public website.2SimplePractice. Security and Third-Party Pixels The privacy policy, last updated on February 1, 2024, states the company has not sold personal information and offers users an opt-out for sharing personal information for targeted advertising.3SimplePractice. Privacy Policy
The Terms of Service Changes That Complicate Suing
On August 2, 2023, SimplePractice updated its Terms of Service. Two changes shape how any lawsuit against the company can proceed.
Section 9.2 granted SimplePractice a “non-exclusive, worldwide, royalty-free, fully paid-up, perpetual, irrevocable, sublicensable (through multiple tiers), and transferable license” to use, reproduce, distribute, and create derivative works from user data.4SimplePractice. Terms of Service The license covers data submitted by users and data generated or collected by SimplePractice through its services, and it survives account termination. Users were also required to waive moral rights related to attribution of their data.5Paubox. Addressing Concerns Around SimplePractice’s Terms and Conditions Section 9.3 extended a similar perpetual license to data obtained from payment processors like Stripe.
The same update added a mandatory binding arbitration clause and a class action waiver. Users could opt out of the arbitration provision, but the class action waiver was non-negotiable, effectively barring therapists from joining group lawsuits against the company.5Paubox. Addressing Concerns Around SimplePractice’s Terms and Conditions The terms include a provision stating that if any conflict arises between the general terms and SimplePractice’s Business Associate Agreement regarding protected health information, the BAA prevails.4SimplePractice. Terms of Service
Enforceability of the class action waiver has not been tested in a reported ruling against SimplePractice. It is the first obstacle any pixel case would need to clear.
Timing and the Vista Equity Buyout
The terms changes arrived weeks before a major corporate deal. On October 23, 2023, EngageSmart, SimplePractice’s parent, announced an all-cash agreement to be acquired by an affiliate of Vista Equity Partners at approximately $4 billion, with stockholders receiving $23.00 per share.6U.S. Securities and Exchange Commission. EngageSmart Inc. Press Release Regarding Vista Equity Partners Acquisition7The Wall Street Journal. Vista Equity Partners Close to $4 Billion Buyout of EngageSmart Under the deal, Vista would hold roughly 65% of the equity and General Atlantic about 35%. The merger closed on January 26, 2024, taking EngageSmart and SimplePractice private.
Critics tied the sequence together: broader data rights and a class action bar, then a sale. Two separate lawsuits target the deal itself, not the pixel allegations. A proposed class action filed in the Delaware Court of Chancery in October 2023 sought to block the buyout on grounds that $23 per share undervalued the company, with analysts having speculated the company was worth $25 to $30 per share.8Bloomberg Law. Vista’s $4 Billion EngageSmart Deal Hit With Court Challenge A separate securities class action, AltShares Event-Driven ETF v. EngageSmart, Inc. (No. 24-cv-1083-RGA), was filed in the District of Delaware in October 2024, alleging violations of the Securities Exchange Act and claiming EngageSmart issued materially misleading statements about its Special Committee’s independence and conflicts involving its financial advisor and controlling shareholder.9Entwistle & Cappucci LLP. Securities Class Action Complaint Filed Against EngageSmart Inc. and Vista Equity Partners Both are shareholder suits about deal price and disclosures. Neither addresses the pixel tracking allegations.
Where the Case Stands
The pixel investigation appears to still be in early stages. One therapist who explored contacting clients about the matter reported being advised by an attorney that action was “premature until the lawsuit is settled.”1Robin Levick. SimplePractice Tracking Pixels No filed complaint with a named plaintiff against SimplePractice has been reported publicly.
The Benchmark Cases
Similar healthcare pixel litigation gives some sense of what a SimplePractice case might look like if one is filed and survives the arbitration and waiver defenses. Mass General Brigham Hospital settled a pixel tracking class action for $18.4 million, and the FTC reached a $7.8 million settlement with BetterHelp over its disclosure of sensitive mental health information.1Robin Levick. SimplePractice Tracking Pixels
The largest benchmark is In re Meta Pixel Healthcare Litigation (No. 3:22-cv-03580, N.D. Cal.), a consolidated action in which plaintiffs identified at least 664 hospital systems or medical providers whose websites allegedly transmitted patient data via Meta’s pixel without valid HIPAA authorization.10Cohen Milstein. In Re Meta Pixel Healthcare Litigation The case has survived two motions to dismiss, with claims including Electronic Communications Privacy Act violations, invasion of privacy, and breach of contract moving forward. A motion for class certification was filed in September 2025.
In June 2025, a federal court in the Southern District of New York denied a motion to dismiss in a similar case against Teladoc Health, allowing eight of twelve claims to proceed, including ECPA violations and state consumer protection claims.11Bloomberg Tax. Teladoc Health to Face Bulk of Pixel Tracking Data Sharing Suit Courts in these cases have increasingly held that telehealth entities function as healthcare providers rather than mere technology platforms, and that medical conditions constitute the “contents” of communications rather than simple tracking metadata.
The Regulatory Backdrop
Federal regulators have pushed on this issue. In December 2022, the HHS Office for Civil Rights issued a bulletin warning that tracking pixels could violate HIPAA by improperly disclosing protected health information to technology vendors, and it explicitly classified individual IP addresses as unique identifiers.12U.S. Department of Health and Human Services. HIPAA Online Tracking In July 2023, the FTC and OCR jointly sent warning letters to approximately 130 hospital systems and telehealth providers. The FTC also pursued enforcement actions against GoodRx, BetterHelp, and Premom for sharing consumer health information with third-party advertisers.13Federal Trade Commission. FTC, HHS Warn Hospital Systems, Telehealth Providers About Privacy and Security Risks From Online Tracking
The picture shifted in June 2024, when a federal court in Texas vacated part of the OCR’s tracking technology guidance. The ruling in American Hospital Association v. Becerra struck down the portion of the guidance saying HIPAA obligations were triggered merely by connecting a person’s IP address with a visit to a public, unauthenticated webpage about a health condition or provider. The court found that portion exceeded HHS’s authority.12U.S. Department of Health and Human Services. HIPAA Online Tracking OCR initially appealed and then withdrew its appeal in August 2024, and had not issued revised guidance to replace the vacated portion as of late 2024.14HealthLaw Advisor. OCR Withdraws Appeal of District Court Order Declaring Unlawful and Vacating the Proscribed Combination Portion of Its HIPAA Online Tracking Technologies Guidance That ruling could help companies defending against claims tied to tracking on public pages. It would not necessarily shield allegations tied to authenticated patient portals, where the link between a user’s identity and a healthcare relationship is more direct, and that is the terrain the SimplePractice allegations occupy.